The vulnerability lies in improper neutralization of special characters within an SQL statement, enabling an attacker to inject malicious code. This flaw permits unauthorized manipulation of the database, potentially allowing the adversary to read, alter, or delete sensitive data. The weakness is classified as an input validation flaw that compromises database integrity and confidentiality.

The issue affects the WC Lovers WCFM Marketplace WordPress plugin for all versions up to and including 3.7.1. Users operating the plugin within this version range are at risk.

The CVSS score of 7.6 reflects a high severity condition, indicating a significant threat if exploited. At present, the EPSS score is not disclosed, suggesting no publicly available metrics. Since the vulnerability is not listed in the CISA KEV catalog, no confirmed exploits are noted in that database. The likely attack vector is a web‑based request that passes unfiltered input to the database, and it requires the attacker to have a way to supply crafted payloads via the affected plugin’s exposed interfaces. If successful, the attacker could gain unauthorized database access, leading to data breach or alteration.